Privacy Policy
Effective
- Registered name
- OPENFILL LTD
- Company number
- 17360288
- Registered office
- 128 City Road, London, EC1V 2NX, United Kingdom
- Jurisdiction
- England and Wales
The personal data we hold about you as an account holder, why we hold it, and the rights you have over it. The handling of your API request content is covered separately in the Data Policy.
1Who we are
OPENFILL LTD is a company registered in England and Wales (company number 17360288), registered office 128 City Road, London, EC1V 2NX, United Kingdom.
We act in two capacities, and which one applies depends on the data. For your account, billing and sign-in data we are the controller: we decide why it is processed, and this policy governs it. For the content of your API requests we are a processor acting on your instructions, and the Data Policy governs that.
2EU representative (Article 27)
OpenFill is established in the United Kingdom and has no establishment in the European Union. We have therefore appointed a representative in the EU under Article 27 of the GDPR.
You can always come to us directly. Write to [email protected] with any question, request or complaint about your personal data. Using the representative is optional, and your right to complain to a supervisory authority is unaffected either way.
If you are in the EU or EEA and would rather raise it with our representative, or want to verify the appointment, their details are:
Euverify Ltd (Ireland)
Unit 3D North Point House North Point Business Park New Mallow Road Cork T23 AT2P Ireland
Email [email protected]
To make a data subject access request, a deletion request, or any other GDPR request, you can use the representative's secure portal. Requests submitted there are logged and tracked, and the same link verifies the appointment.
Open the portal and verify the appointment3What we collect, why, and for how long
| Data | Why | Lawful basis | Kept |
|---|---|---|---|
| Name, email, hashed password, email-verified status | Create and secure your account, sign you in, contact you about the service | Performance of a contract | Until you delete your account |
| Sign-in sessions, including IP address and browser user agent | Keep you signed in, and detect suspicious sign-ins and abuse | Contract, and our legitimate interest in securing accounts | Until you sign out, or you delete your account |
| Balance, top-ups, payment-method reference, auto-recharge settings | Take payment, maintain your balance, prevent payment fraud | Contract, and our legitimate interest in preventing fraud | 6 years, as UK company and tax law requires |
| Referral record: that your account was opened through another customer's link, or that another account was opened through yours; the code; the dates the referral was recorded and the credit was paid | Pay the referral credit described in the Terms of Service | Contract | For the life of both accounts; deleted when either account is deleted |
| Usage records: token counts, the API key used, price applied, amount charged | Bill you accurately, show you your usage, operate the market | Contract | 6 years, as above. The key is unlinked from the record when you delete your account |
| API key hashes and labels, and when each key was last used | Authenticate your API calls, and show you which keys are in use | Contract | Until you delete your account. Revoking a key stops it working at once, and the record is marked revoked rather than removed |
| Key activity: for each API key and day, how many requests it made, the networks they came from (an address cut to its first three parts), the countries our network edge reports for them, and the client libraries that sent them | Detect a leaked or misused key, and answer your questions about where a key was used | Our legitimate interest in securing accounts | 90 days, or until you delete your account |
| Request records: the shape of each request (counts, size, the options it set and the client library that sent it, with no content), each attempt to execute it, and counts of refused requests | Find and fix faults, keep the service reliable, and reconcile what capacity cost us | Our legitimate interest in running a reliable service | 400 days. When you delete your account the request shapes are deleted, and the rest are kept with your account unlinked |
| Account events: changes to your settings and keys, credits, and the request to delete your account, each with when it happened and whether you, our staff or the system made it | Security, support, and resolving disputes about what changed and when | Our legitimate interest in securing accounts and defending claims | Until you delete your account. The deletion request, and the record that deletion was carried out, are kept with the billing records |
| Emails we send you, and support correspondence | Respond to you, and keep a record of what was agreed | Contract, and our legitimate interest in defending claims | A record of each service notice we email you, such as a failed auto-recharge or a finished batch (its kind, when, whether it was accepted for delivery, and the id our email provider gave it, with no address or text), for 400 days, or until you delete your account. Correspondence as long as needed, then deleted |
| Server logs: request identifiers, methods, paths, statuses and timings, with no IP address and no request content | Diagnose faults and keep the service secure | Our legitimate interest in running a reliable, secure service | Overwritten as new entries arrive: each service keeps a fixed amount of log rather than a fixed period |
Providing your email and a password is necessary to have an account: without them we cannot create one. Providing payment details is necessary only if you want to add credits.
Where we rely on legitimate interests, those interests are: securing accounts against takeover, preventing payment fraud and API abuse, keeping the market and the service working for all customers, and defending legal claims. You can object to any of these; see your rights.
4The content of your requests
Your prompts and completions are covered by the Data Policy, which is part of our contract with you. In summary: by default we do not store them, we do not train on them, we do not sell them, and a provider that executes a request for us may use them only to execute it and to operate the service that does so. The Data Policy lists the cases, on our side and on the provider's, in which content exists while storage is off. Storage by us is something you switch on if you want it, for a number of days up to the maximum shown in Settings.
If your prompts contain personal data about other people, you are the controller of that data and we act on your instructions. We have no relationship with those individuals and usually no way to identify them. If one of them contacts us, we will refer them to you and help you respond.
5Automated decisions
Our market is automated. Software decides, without a human involved, whether to admit your request now or leave it queued, what price applies, and whether to reject it for lack of balance or capacity. It also triggers auto-recharge charges if you have enabled them.
These decisions are made to perform our contract with you, they operate on request attributes such as your bid, your balance and available capacity, and they do not profile you or evaluate you as a person. If you think one has gone wrong, contact us and a human will look at it.
7International transfers
We are established in the United Kingdom. Requests execute on capacity we operate ourselves or obtain from providers, in whichever country that capacity is located, and several of our named providers are US-based, so your data may be transferred outside the UK: prompts and completions through the network that carries them, from its point nearest you, and to wherever a request executes, billing to a US payment processor, and account email to a US sender. Stored request bodies, if you turn retention on, sit on servers in the United Kingdom run by a US company. We make no residency claim for any country or region, so if processing must stay within one, OpenFill is unsuitable unless we have agreed that with you in writing. Which stages have a fixed location, and which do not, is set out in the Data Policy.
For the providers named above we rely on adequacy regulations where they apply and otherwise on the Standard Contractual Clauses with the UK Addendum in each provider's agreement. For the providers the table withholds, the Data Policy says what travels with your content and on what terms. You can request a copy of a named provider's safeguards from [email protected], with commercial terms redacted.
9Security
We maintain technical and organisational measures appropriate to the risk, including TLS for data in transit, hashed password storage, optional two-factor authentication on your account, API keys held only as SHA-256 hashes, and card data handled entirely by our payment processor. These are set out in full in the Data Policy.
If a breach of your personal data is likely to be a risk to you, we will report it to the Information Commissioner's Office within 72 hours of becoming aware, and tell you without undue delay where the risk is high. Where other laws set different deadlines, we will meet the shortest that applies.
10Your rights
You can ask us to:
- Give you a copy of your data, and tell you what we do with it.
- Correct anything inaccurate.
- Delete your account and personal data.
- Restrict or stop a particular use, including anything based on our legitimate interests.
- Give you your data in a portable, machine-readable form.
Email [email protected] from the address on your account. We will respond within one month, and within 45 days for requests made under US state law. Exercising these rights costs nothing and we will not treat you differently for it.
What deletion does. Request it under Danger zone in Settings, or by email at the address above. Deletion requires no queued orders and no running batches: the request is refused while any are live, so cancel them first. We then delete your account, your identity and session data, your API keys, the key activity, request shapes, account events (all but the two that record the deletion) and email records described in section 3, and any stored request content, within 30 days. Deletion is irreversible, and your keys stop working immediately. Request a refund of any remaining balance before requesting deletion. Refunds are handled by email and require an active account. We retain billing and usage records for six years as UK tax and company law requires; those records contain no prompt content.
Deleting stored content without deleting the account. Delete stored data, in the same Danger zone, removes every stored result, request and response body, and batch file this account holds, and keeps the account, your keys, your balance and your usage history. It is the narrower request, and it needs no queued orders cancelled: a result a running batch still has to deliver is deleted once that batch finishes. Content stored after you ask is kept, so set retention to Off as well if you want none kept at all. Stored content is held separately from the database and is not backed up, so a deletion made here is final once it completes.
If you are unhappy with how we have handled your data, tell us first and we will try to put it right. You can also complain to the Information Commissioner's Office in the UK, or to the supervisory authority where you live in the EEA.
11Children
OpenFill is for people aged 18 and over. We do not knowingly collect data about children. If you believe a child has given us personal data, tell us and we will delete it. Do not submit personal data about children in your prompts.
12Changes
If we make a material change we will email account holders before it takes effect. The date at the top of this page is its effective date, and we keep previous versions available on request.